redline | f92cfeb06515f18113a950d5bd569a23cdd85514ef509ccff6c5a4e9a08ca4c7

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2176312.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	timeout.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	A8mbwGNHot_Zgnfxr7mZNbzD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iQzNuaCboOhH38l9xcpPCUTm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	A8mbwGNHot_Zgnfxr7mZNbzD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	iQzNuaCboOhH38l9xcpPCUTm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2176312.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	timeout.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	08dQpYzcYDLzCGdOwtWlEUH4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	08dQpYzcYDLzCGdOwtWlEUH4.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation	Thu11f1187a97f50d9c.exe

Loads dropped DLL 64 IoCs

pid	Process
1036	setup_x86_x64_install.exe
1868	setup_installer.exe
1868	setup_installer.exe
1868	setup_installer.exe
1868	setup_installer.exe
1868	setup_installer.exe
1868	setup_installer.exe
1964	setup_install.exe
1964	setup_install.exe
1964	setup_install.exe
1964	setup_install.exe
1964	setup_install.exe
1964	setup_install.exe
1964	setup_install.exe
1964	setup_install.exe
584	cmd.exe
564	cmd.exe
1364	rundll32.exe
564	cmd.exe
680	cmd.exe
1656	cmd.exe
1656	cmd.exe
1692	cmd.exe
1276	cmd.exe
1276	cmd.exe
1628	cmd.exe
1628	cmd.exe
1220	Thu112e5981b78.exe
1220	Thu112e5981b78.exe
1240	cmd.exe
1240	cmd.exe
1980	Thu1170fdf4c09b1.exe
1980	Thu1170fdf4c09b1.exe
2012	Thu118c8b4c3885d897d.exe
2012	Thu118c8b4c3885d897d.exe
1004	cmd.exe
1584	cmd.exe
2044	Thu11f1187a97f50d9c.exe
2044	Thu11f1187a97f50d9c.exe
744	955B.exe
744	955B.exe
1748	Thu1189012621353ba47.exe
1748	Thu1189012621353ba47.exe
300	Thu118764660749a3b.exe
300	Thu118764660749a3b.exe
1636	cmd.exe
1848	Thu113e650b5e.exe
1848	Thu113e650b5e.exe
1288	LzmwAqmV.exe
1288	LzmwAqmV.exe
2012	Thu118c8b4c3885d897d.exe
1980	Thu1170fdf4c09b1.exe
2416	Thu1170fdf4c09b1.exe
2416	Thu1170fdf4c09b1.exe
2312	timeout.exe
2312	timeout.exe
2312	timeout.exe
760	cmd.exe
2988	Thu11b9fee5fd5b3c.exe
2988	Thu11b9fee5fd5b3c.exe
2312	timeout.exe
2312	timeout.exe
2044	Thu11f1187a97f50d9c.exe
2988	Thu11b9fee5fd5b3c.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral3/memory/2236-215-0x0000000000030000-0x0000000000031000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	A8mbwGNHot_Zgnfxr7mZNbzD.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	08dQpYzcYDLzCGdOwtWlEUH4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iQzNuaCboOhH38l9xcpPCUTm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2176312.scr

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com
52	ipinfo.io
53	ipinfo.io
166	ipinfo.io
188	ipinfo.io
190	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2236	2176312.scr
2312	timeout.exe
2292	A8mbwGNHot_Zgnfxr7mZNbzD.exe
2120	08dQpYzcYDLzCGdOwtWlEUH4.exe
2148	iQzNuaCboOhH38l9xcpPCUTm.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 2416	1980	Thu1170fdf4c09b1.exe	63
PID 2012 set thread context of 2408	2012	Thu118c8b4c3885d897d.exe	64
PID 2700 set thread context of 2500	2700	a7Lz1KtxlWgS6irarIXaEB90.exe	126
PID 2548 set thread context of 1856	2548	44CD.exe	134

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1640	1748	WerFault.exe	50
952	2152	WerFault.exe	59

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	955B.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	955B.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	955B.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1600	schtasks.exe
784	schtasks.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
2312	timeout.exe
864	timeout.exe
2600	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1760	taskkill.exe

Modifies system certificate store 2 TTPs 17 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Thu11f1187a97f50d9c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Thu11b9fee5fd5b3c.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Thu11b9fee5fd5b3c.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Thu1189012621353ba47.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Thu1189012621353ba47.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Thu1189012621353ba47.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Thu11b9fee5fd5b3c.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Thu11b9fee5fd5b3c.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Thu118764660749a3b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Thu118764660749a3b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Thu11f1187a97f50d9c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Thu11b9fee5fd5b3c.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	fJnTf8eSh0eN3eLL3kBr7bvl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Thu118764660749a3b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Thu118764660749a3b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	fJnTf8eSh0eN3eLL3kBr7bvl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Thu11f1187a97f50d9c.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	23	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	189	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	190	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	194	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
744	955B.exe
744	955B.exe
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
2236	2176312.scr
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
2312	timeout.exe
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1200	Process not Found
3048	Thu11b9fee5fd5b3c.tmp

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
744	955B.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	556	Thu1160e2804caf.exe
Token: SeCreateTokenPrivilege	300	Thu118764660749a3b.exe
Token: SeAssignPrimaryTokenPrivilege	300	Thu118764660749a3b.exe
Token: SeLockMemoryPrivilege	300	Thu118764660749a3b.exe
Token: SeIncreaseQuotaPrivilege	300	Thu118764660749a3b.exe
Token: SeMachineAccountPrivilege	300	Thu118764660749a3b.exe
Token: SeTcbPrivilege	300	Thu118764660749a3b.exe
Token: SeSecurityPrivilege	300	Thu118764660749a3b.exe
Token: SeTakeOwnershipPrivilege	300	Thu118764660749a3b.exe
Token: SeLoadDriverPrivilege	300	Thu118764660749a3b.exe
Token: SeSystemProfilePrivilege	300	Thu118764660749a3b.exe
Token: SeSystemtimePrivilege	300	Thu118764660749a3b.exe
Token: SeProfSingleProcessPrivilege	300	Thu118764660749a3b.exe
Token: SeIncBasePriorityPrivilege	300	Thu118764660749a3b.exe
Token: SeCreatePagefilePrivilege	300	Thu118764660749a3b.exe
Token: SeCreatePermanentPrivilege	300	Thu118764660749a3b.exe
Token: SeBackupPrivilege	300	Thu118764660749a3b.exe
Token: SeRestorePrivilege	300	Thu118764660749a3b.exe
Token: SeShutdownPrivilege	300	Thu118764660749a3b.exe
Token: SeDebugPrivilege	300	Thu118764660749a3b.exe
Token: SeAuditPrivilege	300	Thu118764660749a3b.exe
Token: SeSystemEnvironmentPrivilege	300	Thu118764660749a3b.exe
Token: SeChangeNotifyPrivilege	300	Thu118764660749a3b.exe
Token: SeRemoteShutdownPrivilege	300	Thu118764660749a3b.exe
Token: SeUndockPrivilege	300	Thu118764660749a3b.exe
Token: SeSyncAgentPrivilege	300	Thu118764660749a3b.exe
Token: SeEnableDelegationPrivilege	300	Thu118764660749a3b.exe
Token: SeManageVolumePrivilege	300	Thu118764660749a3b.exe
Token: SeImpersonatePrivilege	300	Thu118764660749a3b.exe
Token: SeCreateGlobalPrivilege	300	Thu118764660749a3b.exe
Token: 31	300	Thu118764660749a3b.exe
Token: 32	300	Thu118764660749a3b.exe
Token: 33	300	Thu118764660749a3b.exe
Token: 34	300	Thu118764660749a3b.exe
Token: 35	300	Thu118764660749a3b.exe
Token: SeDebugPrivilege	572	fJnTf8eSh0eN3eLL3kBr7bvl.exe
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeDebugPrivilege	2152	5205247.scr
Token: SeDebugPrivilege	2236	2176312.scr
Token: SeDebugPrivilege	2416	Thu1170fdf4c09b1.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeDebugPrivilege	2292	A8mbwGNHot_Zgnfxr7mZNbzD.exe
Token: SeDebugPrivilege	572	fJnTf8eSh0eN3eLL3kBr7bvl.exe
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeDebugPrivilege	2120	08dQpYzcYDLzCGdOwtWlEUH4.exe
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1200	Process not Found
3048	Thu11b9fee5fd5b3c.tmp
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 1868	1036	setup_x86_x64_install.exe	25
PID 1036 wrote to memory of 1868	1036	setup_x86_x64_install.exe	25
PID 1036 wrote to memory of 1868	1036	setup_x86_x64_install.exe	25
PID 1036 wrote to memory of 1868	1036	setup_x86_x64_install.exe	25
PID 1036 wrote to memory of 1868	1036	setup_x86_x64_install.exe	25
PID 1036 wrote to memory of 1868	1036	setup_x86_x64_install.exe	25
PID 1036 wrote to memory of 1868	1036	setup_x86_x64_install.exe	25
PID 1868 wrote to memory of 1964	1868	setup_installer.exe	26
PID 1868 wrote to memory of 1964	1868	setup_installer.exe	26
PID 1868 wrote to memory of 1964	1868	setup_installer.exe	26
PID 1868 wrote to memory of 1964	1868	setup_installer.exe	26
PID 1868 wrote to memory of 1964	1868	setup_installer.exe	26
PID 1868 wrote to memory of 1964	1868	setup_installer.exe	26
PID 1868 wrote to memory of 1964	1868	setup_installer.exe	26
PID 1964 wrote to memory of 1920	1964	setup_install.exe	28
PID 1964 wrote to memory of 1920	1964	setup_install.exe	28
PID 1964 wrote to memory of 1920	1964	setup_install.exe	28
PID 1964 wrote to memory of 1920	1964	setup_install.exe	28
PID 1964 wrote to memory of 1920	1964	setup_install.exe	28
PID 1964 wrote to memory of 1920	1964	setup_install.exe	28
PID 1964 wrote to memory of 1920	1964	setup_install.exe	28
PID 1964 wrote to memory of 584	1964	setup_install.exe	29
PID 1964 wrote to memory of 584	1964	setup_install.exe	29
PID 1964 wrote to memory of 584	1964	setup_install.exe	29
PID 1964 wrote to memory of 584	1964	setup_install.exe	29
PID 1964 wrote to memory of 584	1964	setup_install.exe	29
PID 1964 wrote to memory of 584	1964	setup_install.exe	29
PID 1964 wrote to memory of 584	1964	setup_install.exe	29
PID 1964 wrote to memory of 760	1964	setup_install.exe	30
PID 1964 wrote to memory of 760	1964	setup_install.exe	30
PID 1964 wrote to memory of 760	1964	setup_install.exe	30
PID 1964 wrote to memory of 760	1964	setup_install.exe	30
PID 1964 wrote to memory of 760	1964	setup_install.exe	30
PID 1964 wrote to memory of 760	1964	setup_install.exe	30
PID 1964 wrote to memory of 760	1964	setup_install.exe	30
PID 1964 wrote to memory of 680	1964	setup_install.exe	31
PID 1964 wrote to memory of 680	1964	setup_install.exe	31
PID 1964 wrote to memory of 680	1964	setup_install.exe	31
PID 1964 wrote to memory of 680	1964	setup_install.exe	31
PID 1964 wrote to memory of 680	1964	setup_install.exe	31
PID 1964 wrote to memory of 680	1964	setup_install.exe	31
PID 1964 wrote to memory of 680	1964	setup_install.exe	31
PID 584 wrote to memory of 572	584	cmd.exe	32
PID 584 wrote to memory of 572	584	cmd.exe	32
PID 584 wrote to memory of 572	584	cmd.exe	32
PID 584 wrote to memory of 572	584	cmd.exe	32
PID 1964 wrote to memory of 564	1964	setup_install.exe	33
PID 1964 wrote to memory of 564	1964	setup_install.exe	33
PID 1964 wrote to memory of 564	1964	setup_install.exe	33
PID 1964 wrote to memory of 564	1964	setup_install.exe	33
PID 1964 wrote to memory of 564	1964	setup_install.exe	33
PID 1964 wrote to memory of 564	1964	setup_install.exe	33
PID 1964 wrote to memory of 564	1964	setup_install.exe	33
PID 1964 wrote to memory of 1004	1964	setup_install.exe	34
PID 1964 wrote to memory of 1004	1964	setup_install.exe	34
PID 1964 wrote to memory of 1004	1964	setup_install.exe	34
PID 1964 wrote to memory of 1004	1964	setup_install.exe	34
PID 1964 wrote to memory of 1004	1964	setup_install.exe	34
PID 1964 wrote to memory of 1004	1964	setup_install.exe	34
PID 1964 wrote to memory of 1004	1964	setup_install.exe	34
PID 1920 wrote to memory of 1664	1920	cmd.exe	36
PID 1920 wrote to memory of 1664	1920	cmd.exe	36
PID 1920 wrote to memory of 1664	1920	cmd.exe	36
PID 1920 wrote to memory of 1664	1920	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1920
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu115049bf2e.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:584
    - - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu115049bf2e.exe
        
        Thu115049bf2e.exe
        5⤵
        Executes dropped EXE
        
        PID:572
      - C:\Users\Admin\AppData\Roaming\5205247.scr
        
        "C:\Users\Admin\AppData\Roaming\5205247.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2152 -s 1604
        7⤵
        Program crash
        
        PID:952
      - C:\Users\Admin\AppData\Roaming\2176312.scr
        
        "C:\Users\Admin\AppData\Roaming\2176312.scr" /S
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
      - C:\Users\Admin\AppData\Roaming\7852719.scr
        
        "C:\Users\Admin\AppData\Roaming\7852719.scr" /S
        6⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\7852719.scr"
        7⤵
        
        PID:928
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Delays execution with timeout.exe
        Suspicious behavior: EnumeratesProcesses
        
        PID:2312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu11b9fee5fd5b3c.exe
      4⤵
      Loads dropped DLL
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu11b9fee5fd5b3c.exe
        
        Thu11b9fee5fd5b3c.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu118764660749a3b.exe
      4⤵
      Loads dropped DLL
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu118764660749a3b.exe
        
        Thu118764660749a3b.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:300
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:1760
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu117e9466431bbb9f.exe /mixone
      4⤵
      Loads dropped DLL
      PID:564
    - - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu117e9466431bbb9f.exe
        
        Thu117e9466431bbb9f.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:1800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu116d4ab7efb7.exe
      4⤵
      Loads dropped DLL
      PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu116d4ab7efb7.exe
        
        Thu116d4ab7efb7.exe
        5⤵
        Executes dropped EXE
        
        PID:520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu11787d2b833e6.exe
      4⤵
      Loads dropped DLL
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu11787d2b833e6.exe
        
        Thu11787d2b833e6.exe
        5⤵
        
        PID:744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu113e650b5e.exe
      4⤵
      Loads dropped DLL
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu113e650b5e.exe
        
        Thu113e650b5e.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu112e5981b78.exe
      4⤵
      Loads dropped DLL
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu112e5981b78.exe
        
        Thu112e5981b78.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1220
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu1160e2804caf.exe
      4⤵
      PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu1160e2804caf.exe
        
        Thu1160e2804caf.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1288
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
        5⤵
        
        PID:432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu1170fdf4c09b1.exe
      4⤵
      Loads dropped DLL
      PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu1170fdf4c09b1.exe
        
        Thu1170fdf4c09b1.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu1170fdf4c09b1.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu1170fdf4c09b1.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu1171b1ca5023f5d2.exe
      4⤵
      PID:1648
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu11f1187a97f50d9c.exe
      4⤵
      Loads dropped DLL
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu11f1187a97f50d9c.exe
        
        Thu11f1187a97f50d9c.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Modifies system certificate store
        
        PID:2044
      - C:\Users\Admin\Documents\u6QNO9HTNhQRtjKOlI4RwU5V.exe
        
        "C:\Users\Admin\Documents\u6QNO9HTNhQRtjKOlI4RwU5V.exe"
        6⤵
        Executes dropped EXE
        
        PID:3024
      - C:\Users\Admin\Documents\OpXsDfR8LtrBWULzABdQBjPn.exe
        
        "C:\Users\Admin\Documents\OpXsDfR8LtrBWULzABdQBjPn.exe"
        6⤵
        Executes dropped EXE
        
        PID:2168
      - C:\Users\Admin\Documents\o43edu1ygobu5DL74gXu2l4n.exe
        
        "C:\Users\Admin\Documents\o43edu1ygobu5DL74gXu2l4n.exe"
        6⤵
        Executes dropped EXE
        
        PID:1564
      - C:\Users\Admin\Documents\CYA4qPL9Dub_xmInqCbBr1fG.exe
        
        "C:\Users\Admin\Documents\CYA4qPL9Dub_xmInqCbBr1fG.exe"
        6⤵
        Executes dropped EXE
        
        PID:2896
      - C:\Users\Admin\Documents\7HKhjqvlT2QQLoi07ZNID2wr.exe
        
        "C:\Users\Admin\Documents\7HKhjqvlT2QQLoi07ZNID2wr.exe"
        6⤵
        Executes dropped EXE
        
        PID:1292
      - C:\Users\Admin\Documents\Ur6fOO1ZvtsvKFde3lo9DidH.exe
        
        "C:\Users\Admin\Documents\Ur6fOO1ZvtsvKFde3lo9DidH.exe"
        6⤵
        Executes dropped EXE
        
        PID:2792
      - C:\Users\Admin\Documents\rZEwN2DhWYKQUuJCLAMVZUfT.exe
        
        "C:\Users\Admin\Documents\rZEwN2DhWYKQUuJCLAMVZUfT.exe"
        6⤵
        Executes dropped EXE
        
        PID:2288
      - C:\Users\Admin\Documents\QgE9K7ieeQLh5CdLX68Rzkt_.exe
        
        "C:\Users\Admin\Documents\QgE9K7ieeQLh5CdLX68Rzkt_.exe"
        6⤵
        
        PID:1876
      - C:\Users\Admin\Documents\ZTOKwOyfSg8V7BVEpWJDJEVn.exe
        
        "C:\Users\Admin\Documents\ZTOKwOyfSg8V7BVEpWJDJEVn.exe"
        6⤵
        Executes dropped EXE
        
        PID:2824
      - C:\Users\Admin\Documents\x4cORFl4yVosQs7FvRIqxw8Y.exe
        
        "C:\Users\Admin\Documents\x4cORFl4yVosQs7FvRIqxw8Y.exe"
        6⤵
        Executes dropped EXE
        
        PID:2844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c cmd < Sai.tmp
        7⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        8⤵
        
        PID:2748
      - C:\Users\Admin\Documents\OiUTBz_xuYzExyij6fwGDx5m.exe
        
        "C:\Users\Admin\Documents\OiUTBz_xuYzExyij6fwGDx5m.exe"
        6⤵
        Executes dropped EXE
        
        PID:1768
      - C:\Users\Admin\Documents\KIMbUHFOlomXdTs3CCFASyID.exe
        
        "C:\Users\Admin\Documents\KIMbUHFOlomXdTs3CCFASyID.exe"
        6⤵
        
        PID:1988
      - C:\Users\Admin\Documents\A8mbwGNHot_Zgnfxr7mZNbzD.exe
        
        "C:\Users\Admin\Documents\A8mbwGNHot_Zgnfxr7mZNbzD.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
      - C:\Users\Admin\Documents\iQzNuaCboOhH38l9xcpPCUTm.exe
        
        "C:\Users\Admin\Documents\iQzNuaCboOhH38l9xcpPCUTm.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2148
      - C:\Users\Admin\Documents\qK31gVySIeeY2rKbihDBSsBK.exe
        
        "C:\Users\Admin\Documents\qK31gVySIeeY2rKbihDBSsBK.exe"
        6⤵
        Executes dropped EXE
        
        PID:2100
      - C:\Users\Admin\Documents\cRTv6VT3ptQUxtdr34Gn_RH8.exe
        
        "C:\Users\Admin\Documents\cRTv6VT3ptQUxtdr34Gn_RH8.exe"
        6⤵
        Executes dropped EXE
        
        PID:2856
      - C:\Users\Admin\Documents\s9hJYLc4AciE5UijszYGFXzr.exe
        
        "C:\Users\Admin\Documents\s9hJYLc4AciE5UijszYGFXzr.exe"
        6⤵
        Executes dropped EXE
        
        PID:2848
      - C:\Users\Admin\Documents\a7Lz1KtxlWgS6irarIXaEB90.exe
        
        "C:\Users\Admin\Documents\a7Lz1KtxlWgS6irarIXaEB90.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2700
        
        C:\Users\Admin\Documents\a7Lz1KtxlWgS6irarIXaEB90.exe
        
        C:\Users\Admin\Documents\a7Lz1KtxlWgS6irarIXaEB90.exe
        7⤵
        Executes dropped EXE
        
        PID:2500
      - C:\Users\Admin\Documents\doPLD1HTJo8BlbTtnOzZ8du3.exe
        
        "C:\Users\Admin\Documents\doPLD1HTJo8BlbTtnOzZ8du3.exe"
        6⤵
        
        PID:2716
      - C:\Users\Admin\Documents\NeVkAwk4_XZ5kIvvu307hKRn.exe
        
        "C:\Users\Admin\Documents\NeVkAwk4_XZ5kIvvu307hKRn.exe"
        6⤵
        Executes dropped EXE
        
        PID:2688
      - C:\Users\Admin\Documents\zLaKjvb6vZDxWK_xzWb0zOQi.exe
        
        "C:\Users\Admin\Documents\zLaKjvb6vZDxWK_xzWb0zOQi.exe"
        6⤵
        Executes dropped EXE
        
        PID:1012
      - C:\Users\Admin\Documents\xxeLD8sCHFCdrnG2InrLtUNf.exe
        
        "C:\Users\Admin\Documents\xxeLD8sCHFCdrnG2InrLtUNf.exe"
        6⤵
        Executes dropped EXE
        
        PID:2640
      - C:\Users\Admin\Documents\bR9xOlIJuX1fL0x0BVgw3Kvp.exe
        
        "C:\Users\Admin\Documents\bR9xOlIJuX1fL0x0BVgw3Kvp.exe"
        6⤵
        
        PID:2596
      - C:\Users\Admin\Documents\Anz5ACg3jEW17t3PPfXSRZ87.exe
        
        "C:\Users\Admin\Documents\Anz5ACg3jEW17t3PPfXSRZ87.exe"
        6⤵
        Executes dropped EXE
        
        PID:1228
      - C:\Users\Admin\Documents\GT7vGyiGbo7PvaN4mF8fTy0V.exe
        
        "C:\Users\Admin\Documents\GT7vGyiGbo7PvaN4mF8fTy0V.exe"
        6⤵
        Executes dropped EXE
        
        PID:1704
      - C:\Users\Admin\Documents\08dQpYzcYDLzCGdOwtWlEUH4.exe
        
        "C:\Users\Admin\Documents\08dQpYzcYDLzCGdOwtWlEUH4.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120
      - C:\Users\Admin\Documents\fJnTf8eSh0eN3eLL3kBr7bvl.exe
        
        "C:\Users\Admin\Documents\fJnTf8eSh0eN3eLL3kBr7bvl.exe"
        6⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu118c8b4c3885d897d.exe
      4⤵
      Loads dropped DLL
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu118c8b4c3885d897d.exe
        
        Thu118c8b4c3885d897d.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu118c8b4c3885d897d.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu118c8b4c3885d897d.exe
        6⤵
        Executes dropped EXE
        
        PID:2408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu1189012621353ba47.exe
      4⤵
      Loads dropped DLL
      PID:1240

C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu1189012621353ba47.exe
Thu1189012621353ba47.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 1032
  2⤵
  - Program crash
  PID:1640

C:\Users\Admin\AppData\Local\Temp\is-RHO9A.tmp\Thu11b9fee5fd5b3c.tmp
"C:\Users\Admin\AppData\Local\Temp\is-RHO9A.tmp\Thu11b9fee5fd5b3c.tmp" /SL5="$50156,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zSC47B3AB1\Thu11b9fee5fd5b3c.exe"
1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3048

C:\Users\Admin\AppData\Local\Temp\955B.exe
C:\Users\Admin\AppData\Local\Temp\955B.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:744

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
- Loads dropped DLL
PID:1364

C:\Users\Admin\AppData\Local\Temp\44CD.exe
C:\Users\Admin\AppData\Local\Temp\44CD.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2548
- C:\Users\Admin\AppData\Local\Temp\44CD.exe
  C:\Users\Admin\AppData\Local\Temp\44CD.exe
  2⤵
  PID:1856

C:\Windows\system32\taskeng.exe
taskeng.exe {F3DC25E4-B8FE-4585-898C-51D0243FBF91} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
1⤵
PID:2736
- C:\Users\Admin\AppData\Roaming\thjaieg
  C:\Users\Admin\AppData\Roaming\thjaieg
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:784

C:\Users\Admin\AppData\Local\Temp\8537.exe
C:\Users\Admin\AppData\Local\Temp\8537.exe
1⤵
- Executes dropped EXE
PID:1056

C:\Users\Admin\AppData\Local\Temp\DF3A.exe
C:\Users\Admin\AppData\Local\Temp\DF3A.exe
1⤵
- Executes dropped EXE
PID:2060
- C:\Users\Admin\AppData\Local\Temp\Q7Av7vE14r.exe
  "C:\Users\Admin\AppData\Local\Temp\Q7Av7vE14r.exe"
  2⤵
  - Executes dropped EXE
  PID:596
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\DF3A.exe"
  2⤵
  PID:1756
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:864

C:\Users\Admin\AppData\Local\Temp\A170.exe
C:\Users\Admin\AppData\Local\Temp\A170.exe
1⤵
- Executes dropped EXE
PID:2268

C:\Users\Admin\AppData\Local\Temp\4BC4.exe
C:\Users\Admin\AppData\Local\Temp\4BC4.exe
1⤵
- Executes dropped EXE
PID:2128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\4BC4.exe"
  2⤵
  PID:1944
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery